Skill UI

This comprehensive guide details a multi-step workflow for detecting and extracting covert data hidden within images, audio, and video files. It covers initial metadata analysis, running advanced steganalysis tools (like zsteg, binwalk, stegoveritas), and performing low-level analysis such as Least Significant Bit (LSB) analysis to uncover hidden communication channels used in digital forensics and cybersecurity investigations.

This comprehensive guide details how to perform thorough and passive subdomain enumeration using Subfinder. It is an essential process during the reconnaissance phase of penetration testing, bug bounty hunting, and security assessments. By integrating multiple passive sources (like Shodan, Censys, and Certificate Transparency logs), users can efficiently map the entire attack surface of a target organization, discover forgotten or misconfigured assets, and prepare for subsequent vulnerability scanning.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

OWASP Threat Dragon is an open-source tool designed for security professionals and developers. It guides users through creating detailed data flow diagrams (DFD) to map system architecture. The framework enables the systematic identification of vulnerabilities by applying established methodologies like STRIDE and LINDDUN, culminating in comprehensive, compliance-ready threat model reports.

This tool guides the process of reviewing security findings from DAST and SAST scanners. It uses the OWASP risk rating methodology to classify vulnerabilities (true positive, false positive, needs review) and calculate a comprehensive risk score based on likelihood and impact, ensuring development teams prioritize the most critical issues.

A specialized tool for formalizing and verifying complex mathematical proofs, particularly in Machine Learning and AI theory. It guides users through structuring theorems, identifying explicit assumptions, performing feasibility triage, and ensuring every logical step is rigorously justified, preventing the fabrication of proofs.

A powerful tool for conducting comprehensive academic research and literature reviews. It searches, analyzes, and synthesizes key ideas from multiple sources, including local PDF libraries (Zotero, Obsidian), the general web, and specialized academic databases (Semantic Scholar, DeepXiv). Use this when you need to map the historical context, identify related works, or understand complex concepts across multiple studies on a given topic.

A comprehensive guide for reverse engineering Android malware. It details how to use JADX and accompanying tools (apktool, androguard) to analyze APK metadata, extract permissions, decompile Java/Kotlin source code, and identify malicious functionalities like data exfiltration, C2 communication, and overlay attacks. Ideal for mobile threat analysis and security research.

A comprehensive guide for analyzing .NET malware (C#, VB.NET, F#) using professional tools like dnSpy and de4dot. Learn to decompile code, identify obfuscation techniques (ConfuserEx, SmartAssembly), extract C2 configurations, and debug malicious behavior in stealers and RATs.

An interactive tool designed to discover, select, and assemble specialized teams of AI agents. It supports structured agent collections across different domains (e.g., Engineering, Marketing). Users select multiple roles for a specific task, and the skill launches them in parallel, synthesizing their independent findings into a unified report, including consensus and conflict analysis.

A comprehensive framework for testing REST and GraphQL APIs against Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR). This tool simulates an attacker's behavior by systematically intercepting and modifying object identifiers (IDs, UUIDs, slugs) within API calls. It helps identify critical authorization flaws, ensuring that an authenticated user cannot access or modify resources belonging to other tenants or users, adhering to OWASP API Security Top 10.

A comprehensive methodology for penetration testing web applications to identify broken access control vulnerabilities. This guide covers systematic testing for Role-Based Access Control (RBAC), privilege escalation, insecure direct object references (IDOR), and API authorization flaws in multi-tenant environments. It outlines the use of tools like Burp Suite and ffuf to map endpoints and simulate various user roles.